summaryrefslogtreecommitdiffstats
path: root/src/responder/common/responder.h
Commit message (Collapse)AuthorAgeFilesLines
* DP: Add DP_WILDCARD and SSS_DP_WILDCARD_USER/SSS_DP_WILDCARD_GROUPJakub Hrozek2015-07-151-1/+3
| | | | | | | | | | | | | Related: https://fedorahosted.org/sssd/ticket/2553 Extends the Data Provider interface and the responder<->Data provider interface with wildcard lookups. The patch uses a new "wildcard" prefix rather than reusing the existing user/group prefixes. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* IFP: add FindByCertificate method for User objectsSumit Bose2015-06-191-1/+2
| | | | | | Related to https://fedorahosted.org/sssd/ticket/2596 Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* responders: reset ncache after domains are discovered during startupJakub Hrozek2015-04-091-1/+3
| | | | | | | | | After responders start, they add a lookup operation that discovers the subdomains so that qualifying users works. After this operation is finishes, we need to reset negcache to allow users to be added into the newly discovered domains. Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* Add parse_attr_list_ex() helper functionSumit Bose2014-11-051-0/+2
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* RESPONDERS: Set default value for umaskPavel Reichl2014-10-291-0/+4
| | | | | | Resolves: https://fedorahosted.org/sssd/ticket/2468 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* RESPONDERS: refactor create_pipe_fd()Pavel Reichl2014-10-271-1/+1
| | | | | | | Resolves: https://fedorahosted.org/sssd/ticket/2470 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* responders: Do not initialize pipe fd if already presentMichal Zidek2014-10-221-0/+2
| | | | | | | | Allow to skip initialization of pipe file descriptor if the responder context already has one. Reviewed-by: Pavel Reichl <preichl@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* responder_common: Create fd for pipe in helperMichal Zidek2014-10-221-0/+2
| | | | | | | | Move creating of file descriptor for pipes into helper function and make this function public. Reviewed-by: Pavel Reichl <preichl@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* UTIL: Add a function to convert id_t from a number or a nameJakub Hrozek2014-10-221-1/+1
| | | | | | | | | | | | We need a custom function that would convert a numeric or string input into uid_t. The function will be used to drop privileges in servers and also in the PAC and IFP responders. Includes a unit test to test all code that changed as well as a fix for a misnamed attribute in the csv_to_uid_list function synopsis. Reviewed-by: Pavel Reichl <preichl@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* Make the space override responder-agnosticJakub Hrozek2014-08-131-0/+1
| | | | | | | | | | | https://fedorahosted.org/sssd/ticket/2397 In order to make the override_space option usable by other responders, we need to move the override_space option to the generic responder structure. Reviewed-by: Pavel Březina <pbrezina@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* RESPONDERS: Add a new request sss_parse_inp_sendJakub Hrozek2014-04-221-0/+7
| | | | | | | | | The responders were copying code to parse input and on encountering an uknown domain, send the discover subdomain request. This patch adds a reusable request that can always be called in responders and in case the name can be parsed, just shortcut. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* sbus: Refactor how we export DBus interfacesStef Walter2014-03-141-5/+13
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Most importantly, stop using per connection private data. This doesn't scale when you have more than one thing exporting or exported on a connection. Remove struct sbus_interface and expand sbus_conn_add_interface() function. Remove various struct sbus_interface args to connection initialization functions and make callers use sbus_conn_add_interface() directly. The old method was optimized for exporting one interface on a connection. We'll have connections that export zero, one or more interfaces. To export an interface on a DBus server, call sbus_conn_add_interface() from within the sbus_server_conn_init_fn. To export an interface on a DBus client, call sbus_conn_add_interface() after sbus_new_connection() returns. As before struct sbus_interface represents an object exported via DBus. However it is now talloc allocated. One can set instance data on the struct sbus_interface. This instance data is passed to the various handlers and used in their implementation. However, we now have type safe interface exporting in the various high level sss_process_init() sss_monitor_init() and so on. Introspection support was not in use, and is now gone until we implement it using the metadata (future patch). Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* sbus: Add struct sbus_request to represent a DBus invocationStef Walter2014-03-141-2/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | struct sbus_request represents a request from a dbus client being handled by a dbus server implementation. The struct contains the message, connection and method (and in the future teh property) which is being requested. In the future it will contain caller information as well. sbus_request is a talloc memory context, and is a good place to attach any allocations and memory specific to the request. Each handler accepts an sbus_request. If a handler returns EOK, it is assumed that the handler will finish the request. Any of the sbus_request_*finish() methods can be used to complete the request and send back a reply. sbus_request_return_and_finish() uses the same argument varargs syntax as dbus_message_append_args(), which isn't a great syntax. Document it a bit, but don't try to redesign: The marshalling work (will follow this patch set) will remove the need to use varargs for most DBus implementation code. This patch migrates the monitor and data provider dbus code to use sbus_request, but does not try to rework the talloc context's to use it. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* UTIL: Move sss_parse_name_for_domains declaration to util.hJakub Hrozek2013-10-221-5/+0
|
* Remove duplicate declarationJakub Hrozek2013-10-221-4/+0
|
* Include external headers with #include <foo.h>Jakub Hrozek2013-10-221-5/+7
| | | | | | I find it more readable to include headers from outside the sssd tree with <foo.h>, not "foo.h". The latter should be used for in-tree headers only.
* Lookup domains at startupSumit Bose2013-06-041-0/+4
| | | | | | | | | | | | To make sure that e.g. the short/NetBIOS domain name is available this patch make sure that the responders send a get_domains request to their backends at startup the collect the domain information or read it from the cache if the backend is offline. For completeness I added this to all responders even if they do not need the information at the moment. Fixes https://fedorahosted.org/sssd/ticket/1951
* Add responder_get_domain_by_id()Sumit Bose2013-05-021-0/+3
| | | | | | | | | | | This new call is similar to responder_get_domain() but uses the domain SID as search parameter. Since the length of the stored domain SID is used in the comparison, SIDs of users and groups and be used directly without stripping the RID component. The functionality is not merged into responder_get_domain() to allow to calculate the timeout correctly and return a specific error code if the entry is expired.
* Add two new request types to the data-provider interfaceSumit Bose2013-05-021-1/+3
| | | | | | | The patch adds two new request types for SID related requests. The first one is used if a SID is given and the corresponding object should be found. The second one can be used if the SID for an object is requested but it is not clear if the object is a user or a group.
* Remove unused TALLOC_CTX from responder_get_domain()Sumit Bose2013-05-021-2/+1
| | | | | | Recent refactoring removed the need to copy the domain info data of sub-domains because the related objects will not be removed from memory anymore.
* Move sss_cmd_execute from client to responder code.Jakub Hrozek2013-03-081-1/+3
| | | | | I think it logically belongs there and allows to better exercise the responder commands from unit tests.
* Refactor sysdb initializationSimo Sorce2013-01-151-1/+0
| | | | | | | | | | | | Change the way sysdbs are initialized. Make callers responsible for providing the list of domains. Remove the returned array of sysdb contexts, it was used only by sss_cache and not really necessary there either as that tool can easily iterate the domains. Make sysdb ctx children of their respective domains. Neither sysdb context nor domains are ever freed until a program is done so there shouldn't be any memory hierarchy issue. As plus we simplify the code by removing a destructor and a setter function.
* do not call dp callbacks when responder is shutting downPavel Březina2012-10-111-0/+2
| | | | | | | | | | | | | | https://fedorahosted.org/sssd/ticket/1514 We were experiencing crash duting responder shut down. This happened when there were some unresolved dp request during the shut down. The memory hierarchy is main_ctx->specific_ctx->rctx, where specific_ctx may be one of the pam, nss, sudo, etc. contexts. If we try to call dp request callback as a result of responder termination, the specific context is already semi freed, which may cause crash.
* Add new option default_domain_suffixSumit Bose2012-10-011-0/+3
|
* pac responder: limit access by checking UIDsSumit Bose2012-07-101-0/+10
| | | | | | | | | | | | A check for allowed UIDs is added in the common responder code directly after accept(). If the platform does not support reading the UID of the peer but allowed UIDs are configured, access is denied. Currently only the PAC responder sets the allowed UIDs for a socket. The default is that only root is allowed to access the socket of the PAC responder. Fixes: https://fedorahosted.org/sssd/ticket/1382
* Make the client idle timeout configurableStephen Gallagher2012-06-181-0/+1
|
* Add support for terminating idle connectionsShantanu Goel2012-06-181-0/+2
|
* Make re_expression and full_name_format per domain optionsStef Walter2012-06-121-2/+4
| | | | | | | | | | | * Allows different user/domain qualified names for different domains. For example Domain\User or user@domain. * The global re_expression and full_name_format options remain as defaults for the domains. * Subdomains get the re_expression and full_name_format of their parent domain. https://bugzilla.redhat.com/show_bug.cgi?id=811663
* SSH: Add dp_get_host_send to common responder codeJakub Hrozek2012-05-031-2/+1
| | | | | | | | Instead of using account_info request, creates a new ssh specific request. This improves code readability and will make the code more flexible in the future. https://fedorahosted.org/sssd/ticket/1176
* Modified responder_get_domain()Jan Zeleny2012-04-241-1/+2
| | | | Now it checks for subdomains as well as for the domain itself
* Responder part of the subdomain retrieval workJan Zeleny2012-04-241-0/+11
|
* Use the correct hash table for pending requestsSimo Sorce2012-03-081-1/+5
| | | | | | | | | | | | | The function that handled pending requests on reconnect was checking an orphaned global variable that was never used, redenring the whole function uselsess. This fixes a very nasty bug that was causing requests for which we never received an answer for (for example because the backend failed and was restarted) to be never removed and therefore causing a black hole effect for any other request of the same type. Fixes: https://fedorahosted.org/sssd/ticket/1229
* RESPONDERS: Allow increasing the file-descriptor limitStephen Gallagher2012-02-171-0/+3
| | | | | | | This patch will increase the file descriptor limit to 8k or the limits.conf maximum, whichever is lesser. https://fedorahosted.org/sssd/ticket/1197
* Remove setent structure when callback is calledJakub Hrozek2012-02-131-2/+2
|
* DP: Add support for hosts in sss_dp_get_accountJan Cholasta2012-02-071-1/+2
| | | | Host requests are directed to the host info handler.
* AUTOFS: responderJakub Hrozek2012-02-051-0/+2
|
* Split the logic to check cache expiration into separate functionJakub Hrozek2012-02-051-0/+5
|
* RESPONDERS: Refactor setent_req_listJakub Hrozek2012-02-051-5/+11
| | | | | Makes the setent_add_ref() and setent_notify_*() functions more generic to be reusable by the autofs responder.
* RESPONDERS: Provide a common sss_cmd_send_error functionJakub Hrozek2012-02-021-0/+1
| | | | The common function could be reused in new responders
* Refactor nss_cmd_send_emptyJakub Hrozek2012-01-311-0/+2
|
* NSS: Add service enumeration support to NSS providerStephen Gallagher2012-01-271-0/+3
|
* DP: Refactor responder_dp_req so it's reusable by other respondersJakub Hrozek2012-01-271-7/+49
| | | | | | | | | | | | | | | | | | | | | | | | * the internal request is now more generic and is decoupled from account-specific data. There is a new sss_dp_issue_request() wrapper that issues a BE request or registers a callback * the public requests all use struct sss_dp_req_state as the tevent_req state data. This allows to report back data from the internal request even if the caller is just a callback notifier * each specific request now uses an _info structure that contains all the data necessary to construct a DBusMessage passed to provider * each specific request now defines a sss_dp_get_$data_msg callback that is called from the sss_dp_issue_request() common wraper. The purpose of the wrapper is to construct a DBusMessage and bind it to a DBus method so the message can be just sent over to back end The miscellanous changes include: * change SSS_DP_ constants to an enum. This way, a switch() would error if a value is not handled. * rename sss_dp_get_account_int_send() to sss_dp_internal_get_send() request because the internal request is going to handle more than just account data * the DBus return values were renamed from err_maj, err_min to dp_err and dp_ret respectively
* DP: Add support for services in dp requestsStephen Gallagher2012-01-271-0/+1
|
* RESPONDER: Extend sss_dp_account_send() to include extra dataStephen Gallagher2012-01-211-1/+2
| | | | | | | Some NSS maps such as 'services' require more values to be passed to the data provider than just the name or ID. In these cases, we will amend an optional component to filter value to pass to the data provider backend.
* PAM: make initgroups timeout work across multiple clientsStephen Gallagher2011-12-201-2/+0
| | | | | | | | | | | Instead of timing out the initgroups lookup on a per-cctx basis, we will maintain a hash table of recently-seen users and use this instead. This will allow SSSD to handle user's logging into multiple services simultaneously more graciously, as well as playing nicer with SSH (which makes calls to PAM both before and after a fork). https://fedorahosted.org/sssd/ticket/1063
* Responders: Split getting domain by name into separate functionJakub Hrozek2011-12-161-0/+2
|
* RESPONDER: Refactor DP requests into tevent_req styleStephen Gallagher2011-11-291-6/+32
|
* RESPONDER: Ensure that all input strings are valid UTF-8Stephen Gallagher2011-11-181-0/+2
|
* Allow changing the log level without restartStephen Gallagher2011-05-061-0/+3
| | | | | | We will now re-read the confdb debug_level value when processing the monitor_common_logrotate() function, which occurs when the monitor receives a SIGHUP.
* Update the ID cache for any PAM requestStephen Gallagher2010-12-221-0/+2
| | | | | | | | Also adds an option to limit how often we check the ID provider, so that conversations with multiple PAM requests won't update the cache multiple times. https://fedorahosted.org/sssd/ticket/749
generated by cgit (git 2.34.1) at 2025-09-03 02:24:44 +0000